Top
Best
New

Posted by speckx 3 days ago

Lessons in disabling RC4 in Active Directory (2021)(syfuhs.net)
25 points | 9 comments
throw0101a 12 hours ago|
See perhaps recent story "Kerberoasting" about extracting encrypted service account credentials from Active Directory:

* https://news.ycombinator.com/item?id=45196437

philodeon 14 hours ago||
When you turn off the bad cryptography, the product becomes unusable.

The purpose of a system is what it does.

ethanwillis 13 hours ago|
That quote would mean that the system being unusable without RC4 is exactly the point.

It doesn't mean that a system is what its makers intended for it to do.

philodeon 13 hours ago||
Yes, that is precisely my point.

“ According to an intelligence budget document leaked by Mr. Snowden, the N.S.A. spends more than $250 million a year on its Sigint Enabling Project, which "actively engages the U.S. and foreign IT industries to covertly influence and/or overtly leverage their commercial products’ designs" to make them "exploitable." ... One goal in the agency’s 2013 budget request was to “influence policies, standards and specifications for commercial public key technologies,” the most common encryption method.” —New York Times

ethanwillis 12 hours ago||
Fair point, it just wasn't immediately clear to me :)
gleenn 14 hours ago||
Kinda wild hearing about anything even using MD4. I remember doing an MD5 attack in a security class like 20 years ago. Obviously that kinda what this whole article is about but literally the first time ever hearing "MD4".
tptacek 14 hours ago||
Notably, those attacks aren't problematic in the setting MD4 is used in here (but the "outer" construction iterating it is deeply problematic).
ospray 13 hours ago||
"That's the crazy thing most of the security that active directory uses was built in the 90s or early 00s with windows nt. The have only really been patching it since, security is a great place to see really retro stuff
lousken 14 hours ago|
just like windows 11 gui, security on windows is like putting lipstick on a pig